PT-2011-5224 · Popt+3 · Popt+3

Tavis Ormandy · Published 1970-01-01 · Updated 2023-02-13 · CVE-2011-3378

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RPM versions 4.4.x through 4.9.x rpm package (affected versions not specified) rpm-devel (affected versions not specified) rpm-devel-32bit (affected versions not specified) rpm-devel-64bit (affected versions not specified) rpm-32bit (affected versions not specified) rpm-64bit (affected versions not specified) rpm-x86 (affected versions not specified) popt (affected versions not specified) popt-32bit (affected versions not specified) popt-64bit (affected versions not specified) popt-devel (affected versions not specified) popt-devel-32bit (affected versions not specified) popt-devel-64bit (affected versions not specified) popt-x86 (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed. This is related to the regionSwab function, the headerLoad function, and multiple functions in rpmio/rpmpgp.c. The vulnerability can lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For RPM versions 4.4.x through 4.9.x, update to a version after 4.9.x to resolve the issue. For rpm package, consider disabling the vulnerable functions until a patch is available. For rpm-devel, rpm-devel-32bit, rpm-devel-64bit, rpm-32bit, rpm-64bit, rpm-x86, popt, popt-32bit, popt-64bit, popt-devel, popt-devel-32bit, popt-devel-64bit, popt-x86, restrict access to the vulnerable modules to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability for some of the affected packages.

Exploit

Fix

DoS

Code Injection

Weakness Enumeration

CWE-94

CWE-264

Related Identifiers

ALT-PU-2016-2427

ALT-PU-2021-2518

ALT-PU-2021-2600

BDU:2015-04515

BDU:2015-04516

BDU:2015-04517

BDU:2015-04518

BDU:2015-04519

BDU:2015-04520

BDU:2015-04521

BDU:2015-04522

BDU:2015-04523

BDU:2015-04524

BDU:2015-04591

BDU:2015-04592

BDU:2015-04593

BDU:2015-05389

BDU:2015-05390

BDU:2015-05391

BDU:2015-09653

CVE-2011-3378

RHSA-2011:1349

RHSA-2011_1349

Affected Products

Alt Linux

Rpm

Red Hat

Popt

References · 71

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=741612 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3421 · Security Note
• https://bdu.fstec.ru/vul/2015-05391 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6435 · Security Note
• https://bdu.fstec.ru/vul/2015-04520 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2197 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0060 · Security Note
• https://bdu.fstec.ru/vul/2015-04516 · Security Note
• https://bdu.fstec.ru/vul/2015-06484 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20266 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00000.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2199 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-3378 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3378 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04521 · Security Note